Post #4649721 · Elektrine

2026-09-08 19:54 UTC

Omarchy’s Kitty Config Exposed Users to Remote Code Execution Omarchy has changed its Kitty configuration after a security issue was identified with allow_remote_control yes. That setting allows Kitty’s remote-control protocol to accept commands from terminal output, meaning untrusted output could potentially execute commands as the current user. Kitty itself defaults this setting to no; the exposure came from Omarchy explicitly enabling it so other parts of the desktop could query the active terminal’s working directory. The change disables remote control by default and migrates existing explicit yes settings to no. Users affected by the migration need to fully close and reopen Kitty, as existing processes remain exposed until they exit. There is a small trade-off: Omarchy can no longer reliably determine the active Kitty tab/pane’s working directory via its socket, so new terminal or Files launches may occasionally fall back to the home directory. The associated migration tests reportedly pass, although no live Kitty test was run in the test environment.

Replies (14)

@lemon@sh.itjust.works 2026-09-08 21:08

In Kitty’s defense, the docs mention the risks involved with full remote control, and there several ways to control the scope of permitted actions. It’s tricky though. I’d like my coding agent to be able to control the terminal, but I’ve found it harder to sandbox kitty than, say, a multiplexer like tmux/zellij. Herdr is a bit less obvious.

Open ##4649969
@lonesomeCat@lemmy.ml 2026-09-08 21:30

Clearly the results of either being high on slop or a literal mass exploiter

Open ##4650043
@eager_eagle@lemmy.world 2026-09-08 22:32

That does not allow remote code execution. An attacker still needs a vector like an SSH session to be able to control kitty. And at that point, if they already have a shell session, they don’t need kitty to do damage.

Open ##4650206
@Pacers31Colts18@piefed.social 2026-09-09 02:57

So opinionated.

Open ##4651348
@thingsiplay@lemmy.ml 2026-09-09 04:15

Omarchy can no longer reliably determine the active Kitty tab/pane’s working directory via its socket Imagine this as the reason to allow remote access without questions. I watched an interview and he is proud to fix those issues (there were a few more security issues of this stupidity class) and thinks this is totally normal. And over time after fix after fix, Omarchy will become secure. He admits Omarchy is unsecure at this time. The users are just beta testers, risking getting hacked. I could not trust this project. Even if all issues are fixed, who says no new security issues will make into the project? Omarchy is worse than Ubuntu and Manjaro combined.

Open ##4652516
@Strit@lemmy.linuxuserspace.show 2026-09-09 05:33

This reminds me of the Docker issue they fixed in Omarchy recently. Basically you could get root through the docker socket, because the default user groups included the docker group.

Open ##4652876
@hello_hello@hexbear.net 2026-09-09 21:20

At some level I’m glad things like Omarchy exist because then they silo all the mean and evil people into their own echo chamber. The trash takes itself out.

Open ##4658578
@gnuplusmatt@reddthat.com 2026-09-09 22:28

This is what happens when you let someone vibe code your distro’s config

Open ##4658801
@SocialistVibes01@lemmy.ml 2026-09-10 02:07

Nazi Linux is going well

Open ##4660151
@Fizz@lemmy.nz 2026-09-10 11:50

The funny thing is I think windows does this. I may be wrong

Open ##4663164
@ace_garp@lemmy.world 2026-09-10 12:45

Open ##4663372
@drmoose@lemmy.world 2026-09-10 12:55

13M USD budget “distro” btw

Open ##4663475
@bilb@lemmy.ml 2026-09-10 14:55

Am I going to hear about every insignificant development with Omarchy now because DHH ingratiated himself with a bunch of tech fascists?

Open ##4663998
@bleustenns@lemmy.ml 2026-09-10 15:11

I might get downvoted to hell and back for this, but can we stop talking about this piece of work distro? I don’t think the project needs any more PR, period, it’s what the loser who made it wants. Let the people who for some reason trust this collection of dotfiles and scripts do so in their own foolish bubble.

Open ##4664105